The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill supports a template interpolation system ({{step_N.result.field}}) that enables data flow between sequential tool calls, which can be exploited if a tool output contains malicious instructions.\n- Ingestion points: Untrusted data can enter the planning context via the goal and steps parameters in the create_plan tool and the modifications parameter in the adjust_plan tool (handler.ts).\n- Boundary markers: The skill does not implement delimiters, tags, or 'ignore' instructions to prevent the model from interpreting interpolated data as new commands.\n- Capability inventory: The execute_plan handler has the capability to execute any registered tool in the agent's environment, potentially enabling a chain from a poisoned read operation to a sensitive action.\n- Sanitization: There is no evidence of sanitization, escaping, or validation of interpolated content before it is processed by subsequent tool handlers.

plan-mode